Write the plan, then run a tabletop that breaks it

applied · 90 min · Objective 3.2

Task

Produce a working incident response plan for your lab and then attack it with a tabletop designed to find gaps rather than confirm comfort. Objective 3.2 is outlining the process, and a plan nobody has tested is a document rather than a process.

Steps

  1. Write the plan, kept to two pages of operational content: scope and severity tiers with examples, roles, declaration criteria, decision authority, communication protocol, and evidence handling requirements.
  2. Add the contacts and the out-of-band channel, and test both -- an untested contact list is a list.
  3. Print it, or store it somewhere readable with the collector switched off.
  4. Run the tabletop. Take a realistic scenario -- a precursor detection on the Windows VM at 02:00 -- and talk it through step by step. If you have someone to run it with, have them facilitate and push: you say you would isolate it, who authorised that, call them now.
  5. Introduce three injects partway: the attacker still has access after your containment; the backup you were relying on is unreachable; someone outside the organisation asks about it.
  6. Record every gap the exercise finds, as a finding with an owner and a date -- not as a note in the discussion.
  7. Fix the top three gaps, update the plan, and record the version and date.

Verify

wc -w < /tmp/ir-plan.md
grep -cE "^## " /tmp/ir-plan.md
grep -c "^" /tmp/tabletop-findings.tsv
awk -F'\t' '$2==""' /tmp/tabletop-findings.tsv | wc -l
ls -l /tmp/ir-plan.md /tmp/contacts.tsv

The word count matters: an operational plan over about a thousand words will not be read at 02:00, and that is a design constraint rather than a preference. The findings file must be non-empty -- a tabletop that produced no findings tested nothing -- and the count of findings with no owner must be zero.

Notes

What tabletops find is almost never technical. It is that nobody knew who declares, that the plan was on the machine that is down, that the only person who can restore is away, or that legal expected to be told immediately and never has been.

Findings with no owner are the normal output of a tabletop and the reason tabletops get a reputation for changing nothing. The owner and date are the whole mechanism.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.